The rapid development of the Internet, World Wide Web and E-commerce has made it increasingly important to be able to monitor the traffic going into and coming out of a network in order to discover abnormal network traffic that may be an indication of attacks from hackers or misuse of network resources by users inside the network. A network of computers may be attacked by a hacker using Smurf, Denial of Services (DoS), or be abused by a rogue employee within the network, who may attack some other networks or download pornography.
Various network security software, such as firewalls, Intrusion Detection Systems (IDS), network monitors, and vulnerability assessment tools, have been developed to protect a network from abuse and hacking.
IDS systems are used to spot, alert, and stop intrusions. Typically running on dedicated computers hooked to the network, IDS systems actively monitor network traffic for suspicious activities. Statistics or rule-based artificial intelligence is used to detect abnormal activities. Thus, IDS systems depend on the recognition of known attack patterns. For example, contents in the network traffic may be monitored to match the patterns in an IDS system's databases. The real-time analysis of the network traffic provides the capability to send instant notifications via e-mails, pager alerts, or other means. Based on a predefined security policy, some IDS systems can take defensive actions against intrusions, such as initiating the termination of network connections or changing the configuration of network devices (e.g., firewalls and routers). Since hacking activities and misuse of new patterns are under constant development, IDS systems are also under constant development.
IDS systems have a number of weaknesses. IDS systems depend on the recognition of known attack patterns, sequences, or signatures. Currently known signatures of attacks are collected to write rules to detect and disable network activities with these signatures. However, IDS systems cannot detect or stop the attacks of unknown signatures. IDS systems have to be upgraded when the rules are updated to handle attacks of signatures that are only recently recognized.
A grave concern of network administrators is the exponential increase in attacks seen as the size and reach of the Internet increases with time. A consequence of this is that in the foreseeable future IDSs on networks will be overwhelmed by such attacks and will no longer be able to keep pace with mutating forms of attack.
All of the above issues and techniques and structures to address the issue arise for the anonymous nature of data communications. Unlike real world interactions between people where an identity is exchanged fairly early in the conversation, in cyber space ones identity and hence ones reputation can hide behind a network address. To make matters worse, the Internet is stateless, that is it does not retain information about previous activity that would affect current activity. For example an end user could try to hack into a private network, send an e-mail to a fellow hacker about the attempt and then do on-line banking, without any of the previous activity affecting their access to the banking network.
Even on a larger scale, such as a network, there is no way on knowing whom you are dealing with other than relying on anecdotal information. As a consequence network administrators have to rely on tools to detect intrusion and misuse. The concern is that this kind of behavior will continue to increase to the point where current methods will be overwhelmed by the numbers of such incidents.